11829c7027a6c3bf651624da408e2be0_JaffaCakes118 | Triage

Sharing

General

Target

11829c7027a6c3bf651624da408e2be0_JaffaCakes118
Size

120KB
MD5

11829c7027a6c3bf651624da408e2be0
SHA1

4a3e316320c4e6561bf2e8ec8ad503a55184a7c5
SHA256

20630b585bd16d3e19fba623095f783266bfda4fe0e1ae9354fa1093f93016cd
SHA512

edd1657ff66d93f3b6aab74d2192c4696b88a5288b7ac656925f02e5b2e74ccc139b556a810d9677ae41e22ded010792203120fe4799d6e2e6abc2c38dbde2c9
SSDEEP

3072:g/Y2slXwZY/W+kzeFtxdE8buQpfUOnlrjMpflLKDA:mYHfxCMUQMxz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11829c7027a6c3bf651624da408e2be0_JaffaCakes118

Files

11829c7027a6c3bf651624da408e2be0_JaffaCakes118
.exe windows:8 windows x86 arch:x86

f8b48a577c13270e43838f63f08ab5e3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDiskFreeSpaceW
GetPrivateProfileSectionA
GetDiskFreeSpaceW
GetStringTypeW
lstrcpyW
InterlockedDecrement
ExitProcess
InterlockedIncrement
GetPrivateProfileIntA
SetEnvironmentVariableA
FindResourceW
GetACP
LoadLibraryA
WaitForSingleObject
GetCurrentDirectoryA
GetModuleHandleW
Heap32First
WriteFileEx
GetLongPathNameA
lstrcmpA
GetExitCodeProcess
VirtualAllocEx
GetPrivateProfileIntA

apphelp

AllowPermLayer
SdbCreateMsiTransformFile
ApphelpCheckIME
ApphelpCheckExe

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dbg
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE